chore: bump all dependencies (2026-05-12) + fix silently-broken Vercel docs fetch

[LukeMainwaring]

Summary

• Routine dependency bump (5 backend direct, 11 frontend direct) for 2026-05-12.
• Headline fix: /updating-deps Phase 4 was a silent no-op for weeks — its AWK extraction was anchored on # AI SDK UI / # AI_APICallError section headers that Vercel removed from llms.txt. Replaced with a sitemap-filtered fetch of Fumadocs' documented .md raw-markdown variant, plus loud sanity assertions.
• docs/vercel-ai-sdk-ui.txt refreshed as part of the fix: 99 KB → 271 KB across 28 source pages, now reflects the AI SDK 5/6 transport API (sendMessage, DefaultChatTransport, parts-based messages) instead of the pre-v5 handleInputChange/handleSubmit/input pattern.

Code Review

Verdict: Ship it. The skill fix was reviewed by the code-reviewer subagent — no blockers, mirror parity confirmed, shell idioms correct (while IFS= read -r url instead of bash-only for url in $urls to stay portable across the zsh default on macOS, set -eo pipefail + mktemp/trap cleanup, fail-loud via curl -fsSL plus useChat-presence and >100KB size assertions). Four calibration nits were considered (subshell isolation of set -eo pipefail, tighter size floor, fail-fast intent comment, symptom note) and consciously deferred — none are correctness issues.

Version Changes

Backend (direct)

Package	Old	New	Notes
pydantic-ai	1.89.1	1.94.0
pydantic-evals	1.89.1	1.94.0
pydantic	2.13.3	2.13.4
transformers	5.7.0	5.8.0
braindecode	1.4.0	1.5.0
mypy	1.20.2	2.1.0	Major bump. pre-commit passed cleanly under the bumped floor; see Validation.

Frontend (direct)

Package	Old	New
@ai-sdk/react	3.0.176	3.0.179
ai	6.0.174	6.0.177
@tanstack/react-query	5.100.9	5.100.10
next	16.2.4	16.2.6
react / react-dom	19.2.5	19.2.6
tailwind-merge	3.5.0	3.6.0
@biomejs/biome	2.4.14	2.4.15
@tailwindcss/postcss	4.2.4	4.3.0
tailwindcss	4.2.4	4.3.0
@types/node	25.6.0	25.7.0
postcss	8.5.13	8.5.14
ultracite	7.6.3	7.7.0

Skill Fix Detail

.claude/skills/updating-deps/SKILL.md and its .agents/skills/updating-deps/SKILL.md mirror — Phase 4 replaced.

Why the old block was silently broken: the upstream https://ai-sdk.dev/llms.txt was restructured around guides (RAG / Slackbot / Multi-Modal / Postgres) in early 2026 and no longer carries # AI SDK UI or # AI_APICallError headers. AWK printed nothing → > truncated the file. The autonomous updating-deps-auto always skips Phase 4 under CCR network restrictions, so the symptom only surfaced when the doc-vs-deps drift became obvious.

Why the new block is forward-looking: discovers pages from sitemap.xml (auto-includes new pages, auto-drops removed ones) and pulls each one's .md raw-markdown variant. Response header x-matched-path: /[variants]/llms.mdx/[type]/[...slug] confirms .md is Fumadocs' documented LLM-markdown route, not a hack. Loud-failure assertions catch the realistic breakage cases: empty sitemap filter, missing useChat in output, output unexpectedly small.

updating-deps-auto left unchanged — Phase 4 still skipped under CCR network restrictions, which is unrelated to this fix.

New Patterns / APIs Worth Adopting (deferred)

• AI SDK 5/6 transport-based useChat. The refreshed vercel-ai-sdk-ui.txt is now sharply different from frontend/components/chat.tsx's current usage. The library has moved to useChat({ transport: new DefaultChatTransport({ api: '/api/chat' }) }) with explicit sendMessage/status/stop/regenerate plus a parts-based message model; the codebase still relies on the pre-v5 handleInputChange/handleSubmit/input/content surface. Not applied here — Vercel ships npx @ai-sdk/codemod v6 to handle the bulk migration, and this deserves its own PR with QA.
• pydantic-ai 1.89 → 1.94 spans several minor releases; a focused changelog read is worth doing before relying on any new ordering / capability composition features in agents/capabilities/.

Breaking Changes

• mypy 1.20 → 2.1 is a major version bump. uv run --directory backend pre-commit run --all-files was clean locally, but watch CI for any new strictness defaults the major release flipped on.
• No frontend breaking changes detected in the patch/minor bumps above. AI SDK is still on the 6.x line locally (not the 7.x canary).

Deprecation Warnings

• v4-era useChat API in frontend/components/chat.tsx is now demonstrably out of step with upstream docs (covered above; migration deferred).

Test Plan

• CI green (backend pre-commit + frontend lint)
• docker compose up -d starts cleanly under the bumped backend deps
• Smoke test chat UI end-to-end: greeting → user message → analyze_session tool call → SessionVisualization renders → retrieve_tracks_from_brain_state → RetrievedTracksPanel renders
• Verify the new Phase 4 block actually runs end-to-end during the next interactive /updating-deps (sanity that the doc fetch matches what landed here)

🤖 Generated with Claude Code